how to trim space using grok?

[Gowtham C]

hi,

I need to trim white spaces in front and at the end of a string. i was able
to remove white spaces in front but I couldn't remove the spaces at the
end.
Can anyone help me with this one?

*Code:*

input {
stdin{}
}
filter {
grok {
match => [ "message", "%{SPACE}%{GREEDYDATA:message2}" ]
}
mutate {
replace => [ "message", "%{message2}" ]
}
output{

stdout{
debug => true
codec =>json
}
}

*Input:*

(SPACES) Hello Every One (SPACES)

*Note:*

Number of Spaces vary on each input and i need to get the string "Hello
Every One"(with spaces between them)

[Brian K. Smith]

Hi Gowtham,

Try this for your match line:
match=> ["message", "^\s*%{DATA:message2}\s*$"]

Don't forget you can play around with test cases at http://grokdebug.herokuapp.com/ , which can be a lot faster way to
iterate on things.

The $ character to match the end of the line is key to getting the desired behavior.

Cheers,
BKS

hi,
I need to trim white spaces in front and at the end of a string. i was able to remove white spaces in front but I
couldn't remove the spaces at the end.
Can anyone help me with this one?
*Code:*
input {
stdin{}
}
filter {
grok {
match => [ "message", "%{SPACE}%{GREEDYDATA:message2}" ]
}
mutate {
replace => [ "message", "%{message2}" ]
}
output{
stdout{
debug => true
codec =>json
}
}
*Input:*
(SPACES) Hello Every One (SPACES)
*Note:*
Number of Spaces vary on each input and i need to get the string "Hello Every One"(with spaces between them)
--
Remember: if a new user has a bad time, it's a bug in logstash.
---
You received this message because you are subscribed to the Google Groups "logstash-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to
For more options, visit https://groups.google.com/groups/opt_out.